[comp.sys.mac.system] Virus in After Dark 2.0?

davidw@jessica.stanford.edu (David Whelan) (11/06/90)

I have recently had some difficulties with After Dark 2.0 and am wondering
if anyone else has experienced similar problems.

My Mac IIci recently crashed, and I was unable to restart the system.  (The
computer checked my hard disk and then displayed the "No Disk" icon.)  I tried
to check the disk with Norton Utilities and SUM II, but I couldn't find any
problems.  I believe that I then ran Disinfectant 2.3, which reported damage to
my System file.  I copied a new System and the computer started up okay.

Since I had just installed some new INITs and CDEVs (Boomerang 2.0B7,
DiskLight, UnScrolly, Windows, and hierDA), I removed these and restarted the
system.  Everything seemed to be okay, but the machine kept on crashing.  It
seemed to be doing this whenever After Dark kicked in.  Either it would crash
as soon as Satori (the module I was using) started, or when I moved the mouse
to return to my work.

After a little bit of investigation, I found two new files in the After Dark
Files folder.  They were both <1K After Dark documents.  "Good Vibrations (256
colors)" was created on 29 July 1990 at 4:11 p.m. and last modified on 31 July
1990 at 1:33 a.m.  "Grand Finale" was created on 30 July 1990 at 1:09 a.m. and
last modified on 31 July 1990 at 1:34 a.m.  Even though they are both AD
files, neither of them show up in After Dark's list of modules.  When I
removed these files from the After Dark Files folder, the machine stopped
crashing.

I investigated these two files with ResEdit.  They are very different from
regular AD modules.  They both contain four resources:  MENU, mlnf, RECT, and
sysz.  The "Good Vibrations (256 colors)" MENU resource lists "Satori" and
"Slide Show," two real After Dark modules.  "Grand Finale" is similar, but it
lists six different AD modules.

Since removing these files from the After Dark Files folder seemed to solve my
problems, I decided to forget about the whole thing.  However, a couple of
hours later, the system crashed again.  I immediately checked the After Dark
Files folder.  There were again two new files:  "Space Toasters!" and "Stormy
Skyline."  They are both similar to the previous files.  The creation dates
and times are different, but they were all modified on 31 July 1990 at 1:33-
1:34 a.m.

I removed these files from the After Dark Files folder and removed all of my
After Dark stuff from the System Folder.  Since then, I have had no problems
at all.

Has anyone else experienced any similar problems?  This seems to be some sort
of virus which has infected my After Dark file, but I can't figure it out.  I
am sure that putting a fresh AD on the computer would solve my problems, but
I really want to know what caused this to happen so I can prevent it in the
future.

I am using a Mac IIci with 4MB RAM and an 80MB hard drive.  I'm running System
6.0.4, Finder 6.1.4, Multifinder 6.0.4, and MacsBug 6.2a7.  The following
INITs and CDEVs are also being used:  INIT CDEV 3.0, CloseView, Easy Access,
Gatekeeper, Gatekeeper Aid, MacroMaker, On Cue, SoundMaster, Suitcase II, SUM
Shield INIT, SuperClock 3.8, Temperament 2, The GuardDog, Vaccine 1.0.1,
Disinfectant INIT, and ColorDesk.

If anyone has any ideas as to what could have caused these problems with After
Dark, please post them or send e-mail to me (davidw@jessica.stanford.edu).

Thanks,
David J. Whelan
Junior, Symbolic Systems
Stanford University

pv9y@vax5.cit.cornell.edu (11/06/90)

In article <1990Nov6.043127.27489@portia.Stanford.EDU>,
davidw@jessica.stanford.edu (David Whelan) writes:
> I have recently had some difficulties with After Dark 2.0 and am wondering
> if anyone else has experienced similar problems.

I don't know why the Multimodules are causing your computer to crash,
but they are definitely not viruses and come with the original
distribution disks for After Dark 2.0.

THings like Stormy Skyline are a combination of the Rainstorm module
and the Starry Skyline module and are normally perfectly innocuous.
I'd try pulling everything out and running under Finder to test AD. If
that doesn't work, try it on a different machine. The only conflict
I've had which I can't pin down exactly is that some programs do sound
in a way that seems to cause AD to crash. I was having some troubles
for a while that went away when I told Remember? not to play alert
sounds. Couldn't duplicate the problem at will though. So check for
sound stuff happening when AD crashes as well.

Good luck and I'm sure Bruce Burkhalter will post with more help in a
bit.


> Thanks,
> David J. Whelan
> Junior, Symbolic Systems
> Stanford University
--
Adam C. Engst                         pv9y@vax5.cit.cornell.edu
---------------------------------------------------------------
Editor of TidBITS, the weekly electronic Macintosh news journal

aland@chaos.cs.brandeis.edu (Alan D Danziger) (11/07/90)

This is not a virus...  It might be an incompatibility, though. It
sounds to me like you should just reconfigure After Dark from the
control panel.  Those four files you found are the MultiModule
Settings files which come standard with 2.0.
--

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Alan D. Danziger,           | 753 South St,Waltham MA 02154 | No Jacket
aland@chaos.cs.brandeis.edu | MB 3130 / Brandeis University | Required.
(617) 894-6859              | PO Box 9110 Waltham MA 02254  |   Phil C.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

ack@eleazar.dartmouth.edu (Andy J. Williams) (11/07/90)

davidw@jessica.stanford.edu (David Whelan) writes:

>My Mac IIci recently crashed...
>After a little bit of investigation, I found two new files in the After Dark
>Files folder.  They were both <1K After Dark documents.  "Good Vibrations (256
>colors)" ... There were again two new files:  "Space Toasters!" and "Stormy
>Skyline."  They are both similar to the previous files.  The creation dates
>and times are different, but they were all modified on 31 July 1990 at 1:33-
>1:34 a.m.

Those four files are simply MultiModule data files. They are supposed to live
in their own folder. Did you install AD from the master disk the way the
manual instructs? It is possible that AD tried to load these as regular
modules and crashed since they are not modules but data for a certain module.
I suggest you go back and read your manual about installation and reinstall
the whole shebang from scratch.

>I am using a Mac IIci with 4MB RAM and an 80MB hard drive.  I'm running System
>6.0.4, Finder 6.1.4, Multifinder 6.0.4, and MacsBug 6.2a7.  The following
>INITs and CDEVs are also being used:  INIT CDEV 3.0, CloseView, Easy Access,
>Gatekeeper, Gatekeeper Aid, MacroMaker, On Cue, SoundMaster, Suitcase II, SUM
>Shield INIT, SuperClock 3.8, Temperament 2, The GuardDog, Vaccine 1.0.1,
>Disinfectant INIT, and ColorDesk.

On another note, are you just a little worried about viruses? You have 4
separate virus checking INITs in your system folder which are largely
unneeded. Here at Dartmouth we have been reccomending Disinfectant INIT 2.3
and Gatekeeper Aid (for its WDEF abilities) and that's it. Vaccine is really
old and I question its usefulness at this point. Just the two described
above (along with an always handy copy of disinfectant) should keep the nasties
away from your Mac.

>Thanks,
>David J. Whelan
>Junior, Symbolic Systems
>Stanford University

Anyway, getting back to AD, I do not know if the MultiModule files being
in the wrong place makes a difference, the people from Berkely Systems would
know better than I, but it is a good place to start from...

Good luck.

-Andy

-- 
Andy J. Williams     Snail: RFD 1 #268           Quote: This must be where pies
Consultant                  Lebanon NH, 03766           go when they die.
Kiewit Computation   eMail: ack@dartmouth.edu                -Dale Cooper, TP
Dartmouth College    Phone: 603-646-3417         Disclaimer: I didn't do it.

francis@CIS.OHIO-STATE.EDU (RD Francis) (11/07/90)

After Dark 2.0 includes a module called the Multi-Module.  Each of the
files you list is a default multi-module (pre-set ones distributed
with AD).  Multi-Module lets you combine the effects of two or more
Modules, thus you can have lightning (Zot) striking above a skyline
(Starry Skyline); this is the Stormy Skyline module.

So , the files you eliminated came with your copy of AD 2.0.  I have
no idea why or how they would be causing system difficulties; I
haven't experienced any myself.-- 
R David Francis   francis@cis.ohio-state.edu